@nodetool-ai/runtime 0.7.0-rc.22 → 0.8.1

package/dist/providers/nodetool-provider.js

@@ -0,0 +1,224 @@
+/**
+ * NodeTool's own managed models — the provider behind the credits product.
+ *
+ * Every model in the curated catalog (`NODETOOL_MODELS` in
+ * `@nodetool-ai/protocol`) names a delegate provider + model; this provider
+ * runs the delegate on *platform-owned* keys (`NODETOOL_PLATFORM_FAL_KEY`,
+ * `NODETOOL_PLATFORM_ANTHROPIC_KEY`) rather than the user's. That split is
+ * the whole billing model: calls through `nodetool` are metered against the
+ * user's credit balance server-side, while BYOK providers keep running on the
+ * user's own keys, unmetered.
+ *
+ * Cost is accounted at the delegate's price: each call absorbs the inner
+ * provider's cost delta into this instance, so the host's prediction logging
+ * records real USD under provider "nodetool".
+ *
+ * The provider itself is cloud-only (`CLOUD_ONLY_PROVIDER_IDS`): off the cloud
+ * profile it is never registered, because a desktop or self-hosted server has
+ * no platform keys and no account to bill. Where it does run, a model is
+ * served only when it is both **funded** (the delegate's platform key is set)
+ * and **allowed** (`NODETOOL_CREDIT_MODELS` names it, or names nothing at
+ * all). The listers hide what fails either test and `delegateFor` refuses it,
+ * so a whitelist an operator narrows can never be spent past by a client
+ * holding a stale menu.
+ */
+import { NODETOOL_MODELS, isNonEmptyString, nodetoolModelById } from "@nodetool-ai/protocol";
+import { isCreditModelAllowed } from "@nodetool-ai/config";
+import { BaseProvider } from "./base-provider.js";
+import { FalProvider } from "./fal-provider.js";
+import { AnthropicProvider } from "./anthropic-provider.js";
+const PLATFORM_KEYS = {
+    fal_ai: "NODETOOL_PLATFORM_FAL_KEY",
+    anthropic: "NODETOOL_PLATFORM_ANTHROPIC_KEY"
+};
+export class NodetoolProvider extends BaseProvider {
+    secrets;
+    _absorbedCost = 0;
+    static requiredSecrets() {
+        return [];
+    }
+    constructor(secrets = {}) {
+        super("nodetool");
+        this.secrets = secrets;
+    }
+    platformKey(delegateProvider) {
+        const keyName = PLATFORM_KEYS[delegateProvider];
+        const value = keyName ? this.secrets[keyName] : null;
+        return isNonEmptyString(value) ? value : null;
+    }
+    isFunded(delegateProvider) {
+        return this.platformKey(delegateProvider) != null;
+    }
+    /** Funded by a platform key and whitelisted for spend on this server. */
+    isServable(def) {
+        return this.isFunded(def.delegate.provider) && isCreditModelAllowed(def.id);
+    }
+    /**
+     * The delegate serving a nodetool model id, constructed on platform keys.
+     * A fresh instance per call on purpose: cost is read off the delegate's
+     * cumulative counter after the call, and a shared delegate serving
+     * overlapping calls would double-count one call's cost into another's
+     * absorption window. Construction is cheap — both delegates build their
+     * network clients lazily.
+     */
+    delegateFor(modelId, task) {
+        const def = nodetoolModelById(modelId);
+        if (!def) {
+            throw new Error(`Unknown NodeTool model "${modelId}".`);
+        }
+        if (!isCreditModelAllowed(def.id)) {
+            throw new Error(`NodeTool model "${modelId}" is not available on this server.`);
+        }
+        if (task && Array.isArray(def.tasks) && !def.tasks.includes(task)) {
+            throw new Error(`NodeTool model "${modelId}" does not support ${task}.`);
+        }
+        const delegate = (task === "image_to_image" ? def.editDelegate : undefined) ??
+            (task === "text_to_video" ? def.textDelegate : undefined) ??
+            def.delegate;
+        const key = this.platformKey(delegate.provider);
+        if (!key) {
+            throw new Error(`NodeTool model "${modelId}" is not available on this server ` +
+                `(missing ${PLATFORM_KEYS[delegate.provider]}).`);
+        }
+        const provider = delegate.provider === "fal_ai"
+            ? new FalProvider({ FAL_API_KEY: key })
+            : new AnthropicProvider({ ANTHROPIC_API_KEY: key });
+        return { provider, model: delegate.model };
+    }
+    /** Run a delegated call and absorb the delegate's cost delta as our own. */
+    async absorbing(inner, call) {
+        const before = inner.getTotalCost();
+        try {
+            return await call();
+        }
+        finally {
+            this._absorbedCost += inner.getTotalCost() - before;
+        }
+    }
+    get cost() {
+        return this._absorbedCost;
+    }
+    getTotalCost() {
+        return this._absorbedCost;
+    }
+    resetCost() {
+        this._absorbedCost = 0;
+    }
+    declaredCapabilities() {
+        const capabilities = [];
+        for (const def of NODETOOL_MODELS) {
+            if (!this.isServable(def))
+                continue;
+            if (def.kind === "language")
+                capabilities.push("generate_message");
+            if (def.kind === "image") {
+                capabilities.push("text_to_image");
+                if (def.editDelegate)
+                    capabilities.push("image_to_image");
+            }
+            if (def.kind === "video") {
+                if (def.tasks?.includes("image_to_video"))
+                    capabilities.push("image_to_video");
+                if (def.tasks?.includes("reference_to_video"))
+                    capabilities.push("reference_to_video");
+                if (def.textDelegate)
+                    capabilities.push("text_to_video");
+            }
+            if (def.kind === "tts")
+                capabilities.push("text_to_speech");
+        }
+        return [...new Set(capabilities)];
+    }
+    servableModels(kind) {
+        return NODETOOL_MODELS.filter((def) => def.kind === kind && this.isServable(def));
+    }
+    async getAvailableLanguageModels() {
+        return this.servableModels("language").map((def) => ({
+            type: "language_model",
+            id: def.id,
+            name: def.name,
+            provider: "nodetool"
+        }));
+    }
+    async getAvailableImageModels() {
+        return this.servableModels("image").map((def) => ({
+            type: "image_model",
+            id: def.id,
+            name: def.name,
+            provider: "nodetool",
+            supported_tasks: def.tasks ?? []
+        }));
+    }
+    async getAvailableVideoModels() {
+        return this.servableModels("video").map((def) => ({
+            type: "video_model",
+            id: def.id,
+            name: def.name,
+            provider: "nodetool",
+            supportedTasks: def.tasks ?? []
+        }));
+    }
+    async getAvailableTTSModels() {
+        return this.servableModels("tts").map((def) => ({
+            id: def.id,
+            name: def.name,
+            provider: "nodetool",
+            voices: (def.voices ?? []).map((voice) => voice.id)
+        }));
+    }
+    async textToImage(params) {
+        const { provider, model } = this.delegateFor(params.model.id);
+        return this.absorbing(provider, () => provider.textToImage({
+            ...params,
+            model: { ...params.model, id: model, provider: provider.provider }
+        }));
+    }
+    async imageToImage(images, params) {
+        const { provider, model } = this.delegateFor(params.model.id, "image_to_image");
+        return this.absorbing(provider, () => provider.imageToImage(images, {
+            ...params,
+            model: { ...params.model, id: model, provider: provider.provider }
+        }));
+    }
+    async textToVideo(params) {
+        const { provider, model } = this.delegateFor(params.model.id, "text_to_video");
+        return this.absorbing(provider, () => provider.textToVideo({
+            ...params,
+            model: { ...params.model, id: model, provider: provider.provider }
+        }));
+    }
+    async imageToVideo(image, params) {
+        const { provider, model } = this.delegateFor(params.model.id, "image_to_video");
+        return this.absorbing(provider, () => provider.imageToVideo(image, {
+            ...params,
+            model: { ...params.model, id: model, provider: provider.provider }
+        }));
+    }
+    async referenceToVideo(inputs, params) {
+        const { provider, model } = this.delegateFor(params.model.id, "reference_to_video");
+        return this.absorbing(provider, () => provider.referenceToVideo(inputs, {
+            ...params,
+            model: { ...params.model, id: model, provider: provider.provider }
+        }));
+    }
+    async textToSpeechEncoded(args) {
+        const { provider, model } = this.delegateFor(args.model);
+        return this.absorbing(provider, () => provider.textToSpeechEncoded({ ...args, model }));
+    }
+    async generateMessage(args) {
+        const { provider, model } = this.delegateFor(args.model);
+        return this.absorbing(provider, () => provider.generateMessage({ ...args, model }));
+    }
+    async *generateMessages(args) {
+        const { provider, model } = this.delegateFor(args.model);
+        const before = provider.getTotalCost();
+        try {
+            yield* provider.generateMessages({ ...args, model });
+        }
+        finally {
+            this._absorbedCost += provider.getTotalCost() - before;
+        }
+    }
+}
+export default NodetoolProvider;
+//# sourceMappingURL=nodetool-provider.js.map

package/dist/providers/nodetool-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"nodetool-provider.js","sourceRoot":"","sources":["../../src/providers/nodetool-provider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,iBAAiB,EAGlB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,YAAY,EAA2B,MAAM,oBAAoB,CAAC;AAe3E,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAE5D,MAAM,aAAa,GAA2B;IAC5C,MAAM,EAAE,2BAA2B;IACnC,SAAS,EAAE,iCAAiC;CAC7C,CAAC;AAEF,MAAM,OAAO,gBAAiB,SAAQ,YAAY;IACxC,OAAO,CAA0B;IACjC,aAAa,GAAG,CAAC,CAAC;IAE1B,MAAM,CAAU,eAAe;QAC7B,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,YAAY,OAAO,GAA4B,EAAE;QAC/C,KAAK,CAAC,UAAU,CAAC,CAAC;QAClB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;IAEO,WAAW,CAAC,gBAAwB;QAC1C,MAAM,OAAO,GAAG,aAAa,CAAC,gBAAgB,CAAC,CAAC;QAChD,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACrD,OAAO,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IAChD,CAAC;IAEO,QAAQ,CAAC,gBAAwB;QACvC,OAAO,IAAI,CAAC,WAAW,CAAC,gBAAgB,CAAC,IAAI,IAAI,CAAC;IACpD,CAAC;IAED,yEAAyE;IACjE,UAAU,CAAC,GAAqB;QACtC,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,oBAAoB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC9E,CAAC;IAED;;;;;;;OAOG;IACK,WAAW,CACjB,OAAe,EACf,IAAa;QAEb,MAAM,GAAG,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;QACvC,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,KAAK,CAAC,2BAA2B,OAAO,IAAI,CAAC,CAAC;QAC1D,CAAC;QACD,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CACb,mBAAmB,OAAO,oCAAoC,CAC/D,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAClE,MAAM,IAAI,KAAK,CAAC,mBAAmB,OAAO,sBAAsB,IAAI,GAAG,CAAC,CAAC;QAC3E,CAAC;QACD,MAAM,QAAQ,GACZ,CAAC,IAAI,KAAK,gBAAgB,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC;YAC1D,CAAC,IAAI,KAAK,eAAe,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC;YACzD,GAAG,CAAC,QAAQ,CAAC;QACf,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAChD,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,KAAK,CACb,mBAAmB,OAAO,oCAAoC;gBAC5D,YAAY,aAAa,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CACnD,CAAC;QACJ,CAAC;QACD,MAAM,QAAQ,GACZ,QAAQ,CAAC,QAAQ,KAAK,QAAQ;YAC5B,CAAC,CAAC,IAAI,WAAW,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC;YACvC,CAAC,CAAC,IAAI,iBAAiB,CAAC,EAAE,iBAAiB,EAAE,GAAG,EAAE,CAAC,CAAC;QACxD,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC;IAC7C,CAAC;IAED,4EAA4E;IACpE,KAAK,CAAC,SAAS,CACrB,KAAmB,EACnB,IAAsB;QAEtB,MAAM,MAAM,GAAG,KAAK,CAAC,YAAY,EAAE,CAAC;QACpC,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,EAAE,CAAC;QACtB,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,aAAa,IAAI,KAAK,CAAC,YAAY,EAAE,GAAG,MAAM,CAAC;QACtD,CAAC;IACH,CAAC;IAED,IAAa,IAAI;QACf,OAAO,IAAI,CAAC,aAAa,CAAC;IAC5B,CAAC;IAEQ,YAAY;QACnB,OAAO,IAAI,CAAC,aAAa,CAAC;IAC5B,CAAC;IAEQ,SAAS;QAChB,IAAI,CAAC,aAAa,GAAG,CAAC,CAAC;IACzB,CAAC;IAEkB,oBAAoB;QACrC,MAAM,YAAY,GAAyB,EAAE,CAAC;QAC9C,KAAK,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;YAClC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,SAAS;YACpC,IAAI,GAAG,CAAC,IAAI,KAAK,UAAU;gBAAE,YAAY,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;YACnE,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;gBACzB,YAAY,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;gBACnC,IAAI,GAAG,CAAC,YAAY;oBAAE,YAAY,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;YAC5D,CAAC;YACD,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;gBACzB,IAAI,GAAG,CAAC,KAAK,EAAE,QAAQ,CAAC,gBAAgB,CAAC;oBAAE,YAAY,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;gBAC/E,IAAI,GAAG,CAAC,KAAK,EAAE,QAAQ,CAAC,oBAAoB,CAAC;oBAAE,YAAY,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;gBACvF,IAAI,GAAG,CAAC,YAAY;oBAAE,YAAY,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YAC3D,CAAC;YACD,IAAI,GAAG,CAAC,IAAI,KAAK,KAAK;gBAAE,YAAY,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAC9D,CAAC;QACD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC;IACpC,CAAC;IAEO,cAAc,CAAC,IAAuB;QAC5C,OAAO,eAAe,CAAC,MAAM,CAC3B,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CACnD,CAAC;IACJ,CAAC;IAEQ,KAAK,CAAC,0BAA0B;QACvC,OAAO,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACnD,IAAI,EAAE,gBAAgB;YACtB,EAAE,EAAE,GAAG,CAAC,EAAE;YACV,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,QAAQ,EAAE,UAAU;SACrB,CAAC,CAAC,CAAC;IACN,CAAC;IAEQ,KAAK,CAAC,uBAAuB;QACpC,OAAO,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YAChD,IAAI,EAAE,aAAa;YACnB,EAAE,EAAE,GAAG,CAAC,EAAE;YACV,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,QAAQ,EAAE,UAAU;YACpB,eAAe,EAAE,GAAG,CAAC,KAAK,IAAI,EAAE;SACjC,CAAC,CAAC,CAAC;IACN,CAAC;IAEQ,KAAK,CAAC,uBAAuB;QACpC,OAAO,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YAChD,IAAI,EAAE,aAAa;YACnB,EAAE,EAAE,GAAG,CAAC,EAAE;YACV,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,QAAQ,EAAE,UAAU;YACpB,cAAc,EAAE,GAAG,CAAC,KAAK,IAAI,EAAE;SAChC,CAAC,CAAC,CAAC;IACN,CAAC;IAEQ,KAAK,CAAC,qBAAqB;QAClC,OAAO,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YAC9C,EAAE,EAAE,GAAG,CAAC,EAAE;YACV,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,QAAQ,EAAE,UAAU;YACpB,MAAM,EAAE,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;SACpD,CAAC,CAAC,CAAC;IACN,CAAC;IAEQ,KAAK,CAAC,WAAW,CAAC,MAAyB;QAClD,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC9D,OAAO,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,GAAG,EAAE,CACnC,QAAQ,CAAC,WAAW,CAAC;YACnB,GAAG,MAAM;YACT,KAAK,EAAE,EAAE,GAAG,MAAM,CAAC,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE;SACnE,CAAC,CACH,CAAC;IACJ,CAAC;IAEQ,KAAK,CAAC,YAAY,CACzB,MAAoB,EACpB,MAA0B;QAE1B,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC,WAAW,CAC1C,MAAM,CAAC,KAAK,CAAC,EAAE,EACf,gBAAgB,CACjB,CAAC;QACF,OAAO,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,GAAG,EAAE,CACnC,QAAQ,CAAC,YAAY,CAAC,MAAM,EAAE;YAC5B,GAAG,MAAM;YACT,KAAK,EAAE,EAAE,GAAG,MAAM,CAAC,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE;SACnE,CAAC,CACH,CAAC;IACJ,CAAC;IAEQ,KAAK,CAAC,WAAW,CAAC,MAAyB;QAClD,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC,WAAW,CAC1C,MAAM,CAAC,KAAK,CAAC,EAAE,EACf,eAAe,CAChB,CAAC;QACF,OAAO,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,GAAG,EAAE,CACnC,QAAQ,CAAC,WAAW,CAAC;YACnB,GAAG,MAAM;YACT,KAAK,EAAE,EAAE,GAAG,MAAM,CAAC,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE;SACnE,CAAC,CACH,CAAC;IACJ,CAAC;IAEQ,KAAK,CAAC,YAAY,CACzB,KAAiB,EACjB,MAA0B;QAE1B,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,gBAAgB,CAAC,CAAC;QAChF,OAAO,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,GAAG,EAAE,CACnC,QAAQ,CAAC,YAAY,CAAC,KAAK,EAAE;YAC3B,GAAG,MAAM;YACT,KAAK,EAAE,EAAE,GAAG,MAAM,CAAC,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE;SACnE,CAAC,CACH,CAAC;IACJ,CAAC;IAEQ,KAAK,CAAC,gBAAgB,CAAC,MAA8B,EAAE,MAA8B;QAC5F,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,oBAAoB,CAAC,CAAC;QACpF,OAAO,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,gBAAgB,CAAC,MAAM,EAAE;YACtE,GAAG,MAAM;YACT,KAAK,EAAE,EAAE,GAAG,MAAM,CAAC,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE;SACnE,CAAC,CAAC,CAAC;IACN,CAAC;IAEQ,KAAK,CAAC,mBAAmB,CAAC,IAMlC;QACC,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzD,OAAO,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,GAAG,EAAE,CACnC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,CAAC,CACjD,CAAC;IACJ,CAAC;IAEQ,KAAK,CAAC,eAAe,CAC5B,IAAoD;QAEpD,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzD,OAAO,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,GAAG,EAAE,CACnC,QAAQ,CAAC,eAAe,CAAC,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,CAAC,CAC7C,CAAC;IACJ,CAAC;IAEQ,KAAK,CAAC,CAAC,gBAAgB,CAC9B,IAAqD;QAErD,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzD,MAAM,MAAM,GAAG,QAAQ,CAAC,YAAY,EAAE,CAAC;QACvC,IAAI,CAAC;YACH,KAAK,CAAC,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACvD,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,aAAa,IAAI,QAAQ,CAAC,YAAY,EAAE,GAAG,MAAM,CAAC;QACzD,CAAC;IACH,CAAC;CACF;AAED,eAAe,gBAAgB,CAAC"}

package/dist/providers/oauth/browser-launcher.d.ts

@@ -0,0 +1,23 @@
+/**
+ * BrowserLauncher — opens a URL in the user's default browser.
+ *
+ * Abstracted behind an interface so the provider can be tested without
+ * spawning a real browser, and so non-desktop hosts can supply their own
+ * strategy (e.g. printing the URL for the user to paste).
+ */
+import type { Logger } from "@nodetool-ai/config";
+export interface BrowserLauncher {
+    /** Open `url`. Reject with `BrowserLaunchError` if the browser won't start. */
+    open(url: string): Promise<void>;
+}
+/** Opens URLs via the platform's native "open" command. */
+export declare class DefaultBrowserLauncher implements BrowserLauncher {
+    private readonly platform;
+    private readonly logger?;
+    constructor(options?: {
+        platform?: NodeJS.Platform;
+        logger?: Logger;
+    });
+    open(url: string): Promise<void>;
+}
+//# sourceMappingURL=browser-launcher.d.ts.map

package/dist/providers/oauth/browser-launcher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser-launcher.d.ts","sourceRoot":"","sources":["../../../src/providers/oauth/browser-launcher.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAGlD,MAAM,WAAW,eAAe;IAC9B,+EAA+E;IAC/E,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAClC;AAeD,2DAA2D;AAC3D,qBAAa,sBAAuB,YAAW,eAAe;IAC5D,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAkB;IAC3C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAS;IAEjC,YAAY,OAAO,GAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAO,EAGxE;IAEK,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAerC;CACF"}

package/dist/providers/oauth/browser-launcher.js

@@ -0,0 +1,45 @@
+/**
+ * BrowserLauncher — opens a URL in the user's default browser.
+ *
+ * Abstracted behind an interface so the provider can be tested without
+ * spawning a real browser, and so non-desktop hosts can supply their own
+ * strategy (e.g. printing the URL for the user to paste).
+ */
+import { spawn } from "node:child_process";
+import { BrowserLaunchError } from "./errors.js";
+/** Per-platform command that opens a URL in the default browser. */
+function openCommand(platform) {
+    switch (platform) {
+        case "darwin":
+            return { cmd: "open", args: [] };
+        case "win32":
+            // `start` is a cmd builtin; the empty "" is the (ignored) window title.
+            return { cmd: "cmd", args: ["/c", "start", ""] };
+        default:
+            return { cmd: "xdg-open", args: [] };
+    }
+}
+/** Opens URLs via the platform's native "open" command. */
+export class DefaultBrowserLauncher {
+    platform;
+    logger;
+    constructor(options = {}) {
+        this.platform = options.platform ?? process.platform;
+        this.logger = options.logger;
+    }
+    async open(url) {
+        const { cmd, args } = openCommand(this.platform);
+        await new Promise((resolve, reject) => {
+            const child = spawn(cmd, [...args, url], { stdio: "ignore", detached: true });
+            child.once("error", (err) => reject(new BrowserLaunchError("Could not launch the default browser", { cause: err })));
+            // The launcher process exits quickly; the browser keeps running. Treat a
+            // clean spawn as success and unref so it never blocks process exit.
+            child.once("spawn", () => {
+                child.unref();
+                this.logger?.debug("Opened authorization URL in default browser");
+                resolve();
+            });
+        });
+    }
+}
+//# sourceMappingURL=browser-launcher.js.map

package/dist/providers/oauth/browser-launcher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser-launcher.js","sourceRoot":"","sources":["../../../src/providers/oauth/browser-launcher.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAE3C,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAOjD,oEAAoE;AACpE,SAAS,WAAW,CAAC,QAAyB;IAC5C,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,QAAQ;YACX,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;QACnC,KAAK,OAAO;YACV,wEAAwE;YACxE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,EAAE,CAAC;QACnD;YACE,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IACzC,CAAC;AACH,CAAC;AAED,2DAA2D;AAC3D,MAAM,OAAO,sBAAsB;IAChB,QAAQ,CAAkB;IAC1B,MAAM,CAAU;IAEjC,YAAY,OAAO,GAAoD,EAAE;QACvE,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;QACrD,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,GAAW;QACpB,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACjD,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC1C,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;YAC9E,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAC1B,MAAM,CAAC,IAAI,kBAAkB,CAAC,sCAAsC,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,CACvF,CAAC;YACF,yEAAyE;YACzE,oEAAoE;YACpE,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE;gBACvB,KAAK,CAAC,KAAK,EAAE,CAAC;gBACd,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,6CAA6C,CAAC,CAAC;gBAClE,OAAO,EAAE,CAAC;YACZ,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/providers/oauth/claude-code-credentials.d.ts

@@ -0,0 +1,74 @@
+/**
+ * ClaudeCodeCredentialsStore — reads and writes the credential file the Claude
+ * Agent SDK authenticates from.
+ *
+ * The SDK spawns the bundled `claude` binary, which loads its subscription
+ * credentials from `$CLAUDE_CONFIG_DIR/.credentials.json` (defaulting to
+ * `~/.claude/.credentials.json`) under a `claudeAiOauth` key. Writing that exact
+ * shape is the whole point of this module: a NodeTool login and a `claude login`
+ * produce interchangeable credentials, and {@link ClaudeAgentProvider} needs no
+ * token plumbing of its own.
+ *
+ * The file is not NodeTool's — other keys are preserved on write, and the mode
+ * is forced to 0600 to match what the CLI does.
+ */
+import { type Logger } from "@nodetool-ai/config";
+import type { ClaudeCodeTokens } from "./claude-code-oauth-client.js";
+/** The `claudeAiOauth` entry, field-for-field as the CLI writes it. */
+export interface ClaudeAiOAuthCredentials {
+    accessToken: string;
+    refreshToken: string | null;
+    /** Absolute expiry, epoch ms. */
+    expiresAt: number | null;
+    scopes: string[];
+    subscriptionType: string | null;
+    rateLimitTier: string | null;
+    /** Only set when a non-default OAuth client minted the token. */
+    clientId?: string;
+}
+interface ClaudeCodeCredentialsStoreOptions {
+    /** Override the config directory. Defaults to `$CLAUDE_CONFIG_DIR` or `~/.claude`. */
+    readonly configDir?: string;
+    readonly logger?: Logger;
+}
+/**
+ * The directory the `claude` CLI keeps its state in. `CLAUDE_CONFIG_DIR` is the
+ * CLI's own override — honouring it keeps NodeTool pointed at the same profile
+ * the user's terminal sessions use.
+ */
+export declare function claudeConfigDir(): string;
+export declare class ClaudeCodeCredentialsStore {
+    private readonly configDir;
+    private readonly logger;
+    constructor(options?: ClaudeCodeCredentialsStoreOptions);
+    /** Absolute path of the credential file. */
+    get path(): string;
+    /** The stored OAuth credentials, or null when there is no usable login. */
+    read(): Promise<ClaudeAiOAuthCredentials | null>;
+    /**
+     * Merge a fresh token set into the file, preserving any keys the CLI owns
+     * (and any profile metadata a previous login recorded).
+     */
+    save(params: {
+        tokens: ClaudeCodeTokens;
+        subscriptionType?: string | null;
+        rateLimitTier?: string | null;
+        /** Set only for a non-default OAuth client. */
+        clientId?: string;
+    }): Promise<ClaudeAiOAuthCredentials>;
+    /**
+     * Drop the OAuth entry. Other keys survive; the file itself is removed once
+     * nothing is left in it.
+     */
+    clear(): Promise<boolean>;
+    private readFile;
+    /**
+     * Write via a temp file in the same directory, so a concurrent `claude`
+     * process never observes a half-written credential file.
+     */
+    private writeFile;
+}
+/** True when `expiresAt` has passed (or comes within `skewMs`). */
+export declare function isExpired(credentials: Pick<ClaudeAiOAuthCredentials, "expiresAt">, now: number, skewMs?: number): boolean;
+export {};
+//# sourceMappingURL=claude-code-credentials.d.ts.map

package/dist/providers/oauth/claude-code-credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude-code-credentials.d.ts","sourceRoot":"","sources":["../../../src/providers/oauth/claude-code-credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAYH,OAAO,EAAgB,KAAK,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAChE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAGtE,uEAAuE;AACvE,MAAM,WAAW,wBAAwB;IACvC,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,iCAAiC;IACjC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,iEAAiE;IACjE,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAWD,UAAU,iCAAiC;IACzC,sFAAsF;IACtF,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;;;GAIG;AACH,wBAAgB,eAAe,IAAI,MAAM,CAKxC;AAED,qBAAa,0BAA0B;IACrC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAEhC,YAAY,OAAO,GAAE,iCAAsC,EAK1D;IAED,4CAA4C;IAC5C,IAAI,IAAI,IAAI,MAAM,CAEjB;IAED,2EAA2E;IACrE,IAAI,IAAI,OAAO,CAAC,wBAAwB,GAAG,IAAI,CAAC,CAIrD;IAED;;;OAGG;IACG,IAAI,CAAC,MAAM,EAAE;QACjB,MAAM,EAAE,gBAAgB,CAAC;QACzB,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACjC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC9B,+CAA+C;QAC/C,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAiBpC;IAED;;;OAGG;IACG,KAAK,IAAI,OAAO,CAAC,OAAO,CAAC,CAU9B;YAEa,QAAQ;IAkBtB;;;OAGG;YACW,SAAS;CAexB;AAED,mEAAmE;AACnE,wBAAgB,SAAS,CACvB,WAAW,EAAE,IAAI,CAAC,wBAAwB,EAAE,WAAW,CAAC,EACxD,GAAG,EAAE,MAAM,EACX,MAAM,SAAS,GACd,OAAO,CAET"}

package/dist/providers/oauth/claude-code-credentials.js

@@ -0,0 +1,133 @@
+/**
+ * ClaudeCodeCredentialsStore — reads and writes the credential file the Claude
+ * Agent SDK authenticates from.
+ *
+ * The SDK spawns the bundled `claude` binary, which loads its subscription
+ * credentials from `$CLAUDE_CONFIG_DIR/.credentials.json` (defaulting to
+ * `~/.claude/.credentials.json`) under a `claudeAiOauth` key. Writing that exact
+ * shape is the whole point of this module: a NodeTool login and a `claude login`
+ * produce interchangeable credentials, and {@link ClaudeAgentProvider} needs no
+ * token plumbing of its own.
+ *
+ * The file is not NodeTool's — other keys are preserved on write, and the mode
+ * is forced to 0600 to match what the CLI does.
+ */
+import { chmod, mkdir, readFile, rename, unlink, writeFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { createLogger } from "@nodetool-ai/config";
+import { isObjectLike, isString } from "@nodetool-ai/protocol";
+/** Owner-only file mode, matching the CLI. */
+const FILE_MODE = 0o600;
+/**
+ * The directory the `claude` CLI keeps its state in. `CLAUDE_CONFIG_DIR` is the
+ * CLI's own override — honouring it keeps NodeTool pointed at the same profile
+ * the user's terminal sessions use.
+ */
+export function claudeConfigDir() {
+    const override = process.env.CLAUDE_CONFIG_DIR;
+    return override && override.length > 0
+        ? override
+        : join(homedir(), ".claude");
+}
+export class ClaudeCodeCredentialsStore {
+    configDir;
+    logger;
+    constructor(options = {}) {
+        this.configDir = options.configDir ?? claudeConfigDir();
+        this.logger =
+            options.logger ??
+                createLogger("nodetool.runtime.oauth.claude-credentials");
+    }
+    /** Absolute path of the credential file. */
+    get path() {
+        return join(this.configDir, ".credentials.json");
+    }
+    /** The stored OAuth credentials, or null when there is no usable login. */
+    async read() {
+        const file = await this.readFile();
+        const oauth = file?.claudeAiOauth;
+        return oauth && isString(oauth.accessToken) ? oauth : null;
+    }
+    /**
+     * Merge a fresh token set into the file, preserving any keys the CLI owns
+     * (and any profile metadata a previous login recorded).
+     */
+    async save(params) {
+        const file = (await this.readFile()) ?? {};
+        const previous = file.claudeAiOauth;
+        const credentials = {
+            accessToken: params.tokens.accessToken,
+            refreshToken: params.tokens.refreshToken ?? previous?.refreshToken ?? null,
+            expiresAt: params.tokens.expiresAt,
+            scopes: [...params.tokens.scopes],
+            subscriptionType: params.subscriptionType ?? previous?.subscriptionType ?? null,
+            rateLimitTier: params.rateLimitTier ?? previous?.rateLimitTier ?? null
+        };
+        if (params.clientId)
+            credentials.clientId = params.clientId;
+        await this.writeFile({ ...file, claudeAiOauth: credentials });
+        return credentials;
+    }
+    /**
+     * Drop the OAuth entry. Other keys survive; the file itself is removed once
+     * nothing is left in it.
+     */
+    async clear() {
+        const file = await this.readFile();
+        if (!file?.claudeAiOauth)
+            return false;
+        const { claudeAiOauth: _removed, ...rest } = file;
+        if (Object.keys(rest).length === 0) {
+            await unlink(this.path).catch(() => { });
+        }
+        else {
+            await this.writeFile(rest);
+        }
+        return true;
+    }
+    async readFile() {
+        let raw;
+        try {
+            raw = await readFile(this.path, "utf8");
+        }
+        catch {
+            return null;
+        }
+        try {
+            const parsed = JSON.parse(raw);
+            return isObjectLike(parsed) ? parsed : null;
+        }
+        catch {
+            this.logger.warn("Claude credential file is not valid JSON", {
+                path: this.path
+            });
+            return null;
+        }
+    }
+    /**
+     * Write via a temp file in the same directory, so a concurrent `claude`
+     * process never observes a half-written credential file.
+     */
+    async writeFile(contents) {
+        await mkdir(this.configDir, { recursive: true });
+        const tmp = `${this.path}.${process.pid}.tmp`;
+        await writeFile(tmp, `${JSON.stringify(contents, null, 2)}\n`, {
+            encoding: "utf8",
+            mode: FILE_MODE
+        });
+        try {
+            await rename(tmp, this.path);
+        }
+        catch (err) {
+            await unlink(tmp).catch(() => { });
+            throw err;
+        }
+        await chmod(this.path, FILE_MODE);
+    }
+}
+/** True when `expiresAt` has passed (or comes within `skewMs`). */
+export function isExpired(credentials, now, skewMs = 60_000) {
+    return credentials.expiresAt != null && credentials.expiresAt - skewMs <= now;
+}
+//# sourceMappingURL=claude-code-credentials.js.map

package/dist/providers/oauth/claude-code-credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude-code-credentials.js","sourceRoot":"","sources":["../../../src/providers/oauth/claude-code-credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EACL,KAAK,EACL,KAAK,EACL,QAAQ,EACR,MAAM,EACN,MAAM,EACN,SAAS,EACV,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,YAAY,EAAe,MAAM,qBAAqB,CAAC;AAEhE,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAqB/D,8CAA8C;AAC9C,MAAM,SAAS,GAAG,KAAK,CAAC;AAQxB;;;;GAIG;AACH,MAAM,UAAU,eAAe;IAC7B,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;IAC/C,OAAO,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;QACpC,CAAC,CAAC,QAAQ;QACV,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC;AACjC,CAAC;AAED,MAAM,OAAO,0BAA0B;IACpB,SAAS,CAAS;IAClB,MAAM,CAAS;IAEhC,YAAY,OAAO,GAAsC,EAAE;QACzD,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,eAAe,EAAE,CAAC;QACxD,IAAI,CAAC,MAAM;YACT,OAAO,CAAC,MAAM;gBACd,YAAY,CAAC,2CAA2C,CAAC,CAAC;IAC9D,CAAC;IAED,4CAA4C;IAC5C,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;IACnD,CAAC;IAED,2EAA2E;IAC3E,KAAK,CAAC,IAAI;QACR,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;QACnC,MAAM,KAAK,GAAG,IAAI,EAAE,aAAa,CAAC;QAClC,OAAO,KAAK,IAAI,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7D,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,IAAI,CAAC,MAMV;QACC,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,CAAC;QAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC;QACpC,MAAM,WAAW,GAA6B;YAC5C,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,WAAW;YACtC,YAAY,EACV,MAAM,CAAC,MAAM,CAAC,YAAY,IAAI,QAAQ,EAAE,YAAY,IAAI,IAAI;YAC9D,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS;YAClC,MAAM,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;YACjC,gBAAgB,EACd,MAAM,CAAC,gBAAgB,IAAI,QAAQ,EAAE,gBAAgB,IAAI,IAAI;YAC/D,aAAa,EAAE,MAAM,CAAC,aAAa,IAAI,QAAQ,EAAE,aAAa,IAAI,IAAI;SACvE,CAAC;QACF,IAAI,MAAM,CAAC,QAAQ;YAAE,WAAW,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QAE5D,MAAM,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,IAAI,EAAE,aAAa,EAAE,WAAW,EAAE,CAAC,CAAC;QAC9D,OAAO,WAAW,CAAC;IACrB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,KAAK;QACT,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;QACnC,IAAI,CAAC,IAAI,EAAE,aAAa;YAAE,OAAO,KAAK,CAAC;QACvC,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC;QAClD,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACnC,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAC1C,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,KAAK,CAAC,QAAQ;QACpB,IAAI,GAAW,CAAC;QAChB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC1C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,CAAC;YACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACxC,OAAO,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,CAAE,MAA0B,CAAC,CAAC,CAAC,IAAI,CAAC;QACnE,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,0CAA0C,EAAE;gBAC3D,IAAI,EAAE,IAAI,CAAC,IAAI;aAChB,CAAC,CAAC;YACH,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,SAAS,CAAC,QAAyB;QAC/C,MAAM,KAAK,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACjD,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,MAAM,CAAC;QAC9C,MAAM,SAAS,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;YAC7D,QAAQ,EAAE,MAAM;YAChB,IAAI,EAAE,SAAS;SAChB,CAAC,CAAC;QACH,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YAClC,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IACpC,CAAC;CACF;AAED,mEAAmE;AACnE,MAAM,UAAU,SAAS,CACvB,WAAwD,EACxD,GAAW,EACX,MAAM,GAAG,MAAM;IAEf,OAAO,WAAW,CAAC,SAAS,IAAI,IAAI,IAAI,WAAW,CAAC,SAAS,GAAG,MAAM,IAAI,GAAG,CAAC;AAChF,CAAC"}

package/dist/providers/oauth/claude-code-login.d.ts

@@ -0,0 +1,124 @@
+/**
+ * ClaudeCodeLogin — orchestration for signing in with a Claude subscription,
+ * exactly as the `claude` CLI does it, and persisting the result where the
+ * Claude Agent SDK will find it.
+ *
+ * Two completion paths share one authorization request:
+ *
+ *  - **Loopback** — the browser is redirected to an ephemeral `127.0.0.1`
+ *    listener this process binds. Works when the browser runs on the same
+ *    machine as the server (desktop, local dev).
+ *  - **Manual** — the console shows a `<code>#<state>` string the user pastes
+ *    back. The only option on a headless or remote host.
+ *
+ * The two differ only in `redirect_uri`, which must match between the
+ * authorization request and the token exchange — hence the two URLs handed back
+ * from {@link ClaudeCodeLogin.begin} and the `manual` flag carried through to
+ * completion.
+ */
+import { type Logger } from "@nodetool-ai/config";
+import { ClaudeCodeCredentialsStore, type ClaudeAiOAuthCredentials } from "./claude-code-credentials.js";
+import { ClaudeCodeOAuthClient, type ClaudeCodeLoginMethod } from "./claude-code-oauth-client.js";
+import { LocalCallbackServer } from "./local-callback-server.js";
+import { PKCEHelper } from "./pkce-helper.js";
+import { type Clock } from "./types.js";
+/** How long a started login stays completable before the listener is torn down. */
+export declare const CLAUDE_LOGIN_TIMEOUT_MS: number;
+export interface ClaudeCodeLoginOptions {
+    /** Sign in with a claude.ai subscription (default) or a console account. */
+    readonly loginMethod?: ClaudeCodeLoginMethod;
+    /**
+     * Skip the loopback listener entirely. Set on hosts where the browser can't
+     * reach this process — only the manual paste path will be offered.
+     */
+    readonly manualOnly?: boolean;
+    /** Abort waiting for the redirect. */
+    readonly timeoutMs?: number;
+}
+/** Non-secret summary of a stored login. */
+export interface ClaudeCodeAuthStatus {
+    readonly connected: boolean;
+    readonly expiresAt: number | null;
+    readonly expired: boolean;
+    readonly scopes: readonly string[];
+    readonly subscriptionType: string | null;
+    readonly rateLimitTier: string | null;
+    /** Where the credentials live, so the UI can point at the right file. */
+    readonly credentialsPath: string;
+}
+/** A login in progress: the URLs to open, and the two ways to finish it. */
+export interface PendingClaudeCodeLogin {
+    /** Authorization URL for the loopback flow. Null when `manualOnly`. */
+    readonly authUrl: string | null;
+    /** Where the loopback flow sends the browser. Null when `manualOnly`. */
+    readonly redirectUri: string | null;
+    /** Authorization URL whose redirect shows a paste-able `code#state`. */
+    readonly manualAuthUrl: string;
+    /** CSRF state; the caller may key the pending login on it. */
+    readonly state: string;
+    /**
+     * Wait for the browser to hit the loopback listener, then exchange and
+     * persist. Rejects if the login was started with `manualOnly`.
+     */
+    waitForRedirect(signal?: AbortSignal): Promise<ClaudeAiOAuthCredentials>;
+    /**
+     * Finish from a pasted `code#state` (or a bare code plus the state this
+     * object carries). Exchanges against the manual redirect URI and persists.
+     */
+    completeWithPastedCode(input: string): Promise<ClaudeAiOAuthCredentials>;
+    /** Tear down the listener. Idempotent; safe to call after completion. */
+    cancel(): Promise<void>;
+}
+export interface ClaudeCodeLoginDeps {
+    readonly client?: ClaudeCodeOAuthClient;
+    readonly credentials?: ClaudeCodeCredentialsStore;
+    readonly pkce?: PKCEHelper;
+    /** Factory so tests can supply a fake listener. */
+    readonly callbackServerFactory?: () => LocalCallbackServer;
+    readonly clock?: Clock;
+    readonly logger?: Logger;
+}
+export declare class ClaudeCodeLogin {
+    private readonly client;
+    private readonly credentials;
+    private readonly pkce;
+    private readonly callbackServerFactory;
+    private readonly clock;
+    private readonly logger;
+    constructor(deps?: ClaudeCodeLoginDeps);
+    /** Where the credentials the SDK reads are stored. */
+    get credentialsPath(): string;
+    /**
+     * Start an authorization request. Binds the loopback listener (unless
+     * `manualOnly`) and returns both authorization URLs plus the handles to
+     * finish the flow. The caller owns teardown via `cancel()`.
+     */
+    begin(options?: ClaudeCodeLoginOptions): Promise<PendingClaudeCodeLogin>;
+    /** Non-secret summary of the stored login. */
+    status(): Promise<ClaudeCodeAuthStatus>;
+    /**
+     * Refresh the stored access token. Returns the credentials unchanged when
+     * they are still valid, unless `force` is set.
+     *
+     * The `claude` CLI refreshes on its own, so this is for callers that need a
+     * usable token *outside* the SDK (status display, `CLAUDE_CODE_OAUTH_TOKEN`)
+     * rather than a prerequisite for running the provider.
+     */
+    refresh(options?: {
+        force?: boolean;
+        signal?: AbortSignal;
+    }): Promise<ClaudeAiOAuthCredentials>;
+    /** Remove the stored login. Returns false when there was nothing to remove. */
+    logout(): Promise<boolean>;
+    private exchangeAndStore;
+}
+/**
+ * Parse what the console shows after a manual authorization: `<code>#<state>`.
+ * A bare code is accepted too, falling back to the state of the login it is
+ * completing — but a mismatched state is a CSRF signal and always rejected.
+ */
+export declare function parsePastedCode(input: string, expectedState: string): {
+    code: string;
+    state: string;
+};
+//# sourceMappingURL=claude-code-login.d.ts.map